Privacy policy
Summary
- We only process what we need to answer you, schedule your session and invoice it.
- Session files stay in our archive for 6 months after delivery and are then deleted.
- The contact form runs through FormSubmit in the United States, covered by standard contractual clauses.
- We do not sell data and use no advertising or analytics cookies.
- Ask for access, correction or deletion at [email protected]; we answer within one month.
01 Who is responsible
The controller under the General Data Protection Regulation (GDPR) is Vedrodev B.V., Overtoom 293, 1054 HW Amsterdam, registered with the Dutch Chamber of Commerce (KvK) under number 85771006 and managed by Joris van Leeuwen.
Send privacy questions to [email protected] or call 020 846 3172 (Mon–Fri 10–22, Sat 11–18). A studio of our size is not required to appoint a data protection officer, so Joris van Leeuwen handles these questions personally. Company details are in the legal notice.
02 What we collect
- Contact details: name, e-mail address and, if you give it, phone number from the contact page or your e-mail.
- Booking details: service, date and length of the session, number of people and anything you tell us about the project.
- Billing details: company name, address, VAT number and payment records such as the deposit and balance.
- Recordings: audio files, stems and session files containing your voice or playing, plus engineer notes.
- Technical data: IP address, browser type and time of visit in our host's server logs.
We do not ask for special categories of data. A voice recording is not treated as biometric data as long as it is not used to identify someone technically, and we never use it that way.
03 Purposes and legal bases
| Purpose | Legal basis (Art. 6(1) GDPR) |
|---|---|
| Answering your question or quote request | Steps at your request before a contract (b) |
| Planning, recording, mixing or mastering and delivering files | Performance of the contract (b) |
| Invoicing and keeping accounts | Legal obligation (c) |
| Keeping the site secure through server logs | Legitimate interest (f) |
| Remembering your cookie choice | Strictly necessary, see the cookie policy |
No newsletters, no profiling and no automated decisions about you.
04 The contact form and transfers outside the EU
The form on the contact page is handled by FormSubmit, a US service that forwards your message to us by e-mail. Your name, e-mail address, phone number and message therefore pass briefly through servers outside the European Economic Area.
We rely on the European Commission's standard contractual clauses (Art. 46 GDPR) for this transfer and keep the form to the minimum fields needed to reply. If you prefer to avoid it, e-mail or call us directly at [email protected] or 020 846 3172.
05 Who we share data with
- TransIP B.V., Schipholweg 9B, 2316 XB Leiden, Nederland: website hosting and server logs, within the EU.
- FormSubmit: forwarding form messages, as described above.
- Our accountant and bank: bookkeeping and payment processing.
Processors work under agreements as required by Article 28 GDPR. We never sell data and never pass your recordings to third parties such as labels or distributors unless you instruct us to.
06 How long we keep it
- Messages that do not lead to a booking: up to 12 months after the last contact.
- Recording, mix and master files: 6 months after delivery, then permanently deleted, so keep your own copy safe.
- Invoices and accounts: seven years, because of the Dutch tax retention duty.
- Server logs: only as long as the host technically needs, usually a few weeks.
07 Security
The site runs entirely over HTTPS. Project files sit on encrypted storage in the studio with a separate backup, and only the Vedrodev team has access. Deliveries go out through download links that expire after a limited time. If a breach puts you at risk, we report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours and tell you directly where needed.
08 Your rights
You can ask for access, rectification, erasure, restriction, data portability, and object to processing based on legitimate interest. Write to [email protected]. We may ask you to confirm who you are, but never for a copy of your passport. We answer within one month; for complex requests this can be extended by two months, and we will tell you if so.
If you are under 16, a parent or guardian books the session and exercises these rights on your behalf.
09 Complaints
If something bothers you about how we handle your data, tell us first; it is usually quick to fix. You can always lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch supervisory authority. Business clients who have us process material containing other people's data will find the terms in the data processing agreement.
10 Changes
We update this policy when our practice or the law changes. This version was last updated on 5 October 2026 and applies from 5 October 2026. The Dutch text is legally authoritative; this English version is for information. See also the terms and conditions and the accessibility statement.